The present invention relates to a method and system for sending data and other information based on protocol standards developed by the International Standards Organization (ISO), related to smart card applications, and more particularly to a method and system for deployment of smart card applications on data networks, such as IP and broadband in view of ISO-7816.
Smart cards have been employed in the field of financial transaction systems to store value, owing to their ability to contain cryptographic engines and store secret keys securely. As such, they have come to be regarded as a cheap tamper-proof repository for secure data, such as loyalty value, personal identification (ID) information, and even cash value.
All smart card applications are built around a standard specified by the International Standards Organization (ISO) as ISO-7816. This standard specifies a framework for storing data within the card and a basic operating Application Programming Interface (API) for commanding the card to perform its functions.
All smart card applications requiring cryptographic authentication usually require two or more smart cards, one card held by an entity desiring authentication and another card held by an authenticating authority that carries out the authenticating protocol defined by the application. This authentication process involves the two smart cards exchanging data in some form of a challenge and response scenario.
The ISO-7816 committee was well aware that many applications would require multiple smart cards, as well as non smart card devices, to support the applications. These devices include user interface displays, data storage, and keyboards. The committee also knew that these smart card devices and non-smart card supporting devices would need to be addressable from within any card or device within the application. As a result, the committee specified that smart card devices and supporting devices could optionally communicate with each other on a simple bus network, for which a protocol for an application component device was described to facilitate interaction between the devices over this bus.
The name given to the protocol was T=1, and it merely required that any data going into or out of any component device within the application be prepended with a header that specified the device address from which the data was sent, called a Source Node Address, and a device address, to which the application desired the data be sent, called the Destination Node Address.
Under the protocol, the T=1 Router within the application would route data to the Destination Node Address specified in the header. Application designers who did not desire to avail themselves of this feature would use the T=0 protocol, in which no header is prepended to data going to or from the smart card.
Typical applications for the T=1 protocol are microprocessor-based purchase terminals for smart card based cash applications, in which the T=1 addressable nodes are always hard-wire connected together and consequently reside on the same circuit board. These terminals typically are used in retail establishments to transfer value from a customer""s smart card to the merchant""s smart card. However, there is a growing need for these same applications to run in topologies where the T=1 addressable Nodes cannot be wired together as they are in an embedded terminal. One such topology is a network application where one smart card may be on a personal computer (PC) on the Internet and another may be in an Internet Server.
The ISO committee did not address the issue of smart cards and their supporting non-smart card application components communicating over a network. Consequently, no standards currently exist in the ISO-7816 specification for connecting smart card application components over a network.
There is therefore a recognized need in the art for an application that connects and allows for secure and quick data transfer over networks.
An embodiment of the present invention advantageously permits ISO-7816 smart cards and their non-smart card supporting devices to be connected and interact over IP, broadband and Wide Area Networks (WAN) networks using the T=1 protocol, just as if they were connected locally. The invention takes a node address in a T=1 embedded terminal and maps each address into a network address, such as a Universal Resource Locator (URL), such that different components of the terminal that are T=1 addressable may exist throughout, for example, an IP network. The advantages offered by the invention include security and speed, resulting in increased ease of use. Furthermore, the invention gives the smart card autonomy and independence by enabling it to contain within itself all the network addresses of the components of the application of which it is a part.
Smart card addressable nodes and non-smart card addressable nodes can send and receive data to and from any other Addressable Node with no xe2x80x9cknowledgexe2x80x9d of where those addressable nodes may be located (e.g., in the microprocessor""s memory, on a device connected by serial IO line, or on a computer on a remote network). This provides an improvement over the prior art by allowing embedded smart card applications to be ported to large networks with little modification.
The present invention also allows new applications to be developed that can avail themselves of a network connectivity mechanism that allows programs inside the smart cards themselves to autonomously configure the network topology and then issue commands to send and receive data to the application components of the network.
In one embodiment, the present invention relates to a method for routing data between a microprocessor on a smart card and a component device over at least one network. The method comprises sending data from the microprocessor on the smart card to a router through a smart card address handler. The router is preferably an extended T=1 router and includes a first extended routing table. The data is then routed over the network. In routing the data, the data is sent from the router to a network-coupled address handler to the network. The data from the smart card may be routed to an internet protocol network, to a broadband network, to a wide area network or another network through which data is normally sent. The data is received at a second router that is hard wire connected to the component device. In receiving the data at the second router, the data is received from the network and sent through a second network-coupled address handler to the second router. The second router is preferably an extended T=1 router and comprises a second extended routing table. The data is then sent from the second router to the component device through a node address handler. In one embodiment, the second component is a security access module. The security access module may be a second smart card that authenticates the first smart card. In another embodiment, the component device may be a terminal application responsible for starting and operating a terminal. In a further embodiment, the component device may be a data storage device, responsible for storing data from smart cards in non-volatile memory. In another embodiment, the component device may be a terminal having a display device and an input device, such as a keyboard or a mouse.
In another embodiment, data is routed between a first cluster and a second cluster over at least one network. The data is sent from the first cluster to a network by sending the data from a first component device through a first node address handler to a first router and through a network-coupled address handler to the network. In one embodiment, the first component device is a smart card having a microprocessor. The first router is preferably an extended T=1 router, including a first extended routing table. From the network, the data is received at the second cluster. To receive the data at the second cluster, the data is received from the network at a second network-coupled address handler. The data is then sent through a second router and a second node address handler to a second component device. In one embodiment, the second component device is a security access module, including a second smart card that authenticates a smart card from the first cluster. The second router is preferably an extended T=router, including an extended routing table.
In another method for sending data between a first cluster and a second cluster over at least one network, the first cluster may comprise more than one component device, where each component device has its own node address handler associated with it. Data is sent from the first cluster to a network by sending data from one of the component devices through the node address handler associated with the component device to a router. The router is preferably an extended T=1 router, including an extended routing table. From the router, the data is sent through a network-coupled address handler to the network. In one embodiment, a first component device in the first cluster is a smart card having a microprocessor. A second component device in the first cluster may be a terminal having a display device and a keyboard. The data may be sent from the first cluster to the second cluster over an internet protocol network, over a broadband network, over a wide area network or over another network through which data is normally sent. The data is received from the network at the second cluster. In an embodiment of the present invention, the second cluster may include more than one component device, where each component device has its own node address handler associated with it. In receiving the data at the second cluster, data is received from the network at a second network-coupled address handler and sent through a router to one of the component devices via the node address handler associated with the component device. The router is preferably an extended T=1 router, including an extended routing table. In one embodiment of the present invention, a first component device in the second cluster is a security access module, including a second smart card that authenticates a smart card in the first cluster. A second component device in the second cluster may be a data storage device, wherein the data storage device and the smart card send and receive data using the node address handlers and the second router. Among other functions, the data storage device may be responsible for storing data from smart cards in non-volatile memory. In another embodiment, a third component device in the second cluster is a clearing and settlement device.
Another embodiment of the present invention relates to a system for routing data between a smart card having a microprocessor and a component device over at least one network. The system includes means for sending data from the smart card to a first router. The means for sending the data from the smart card to the first router is preferably a first smart card address handler. The system further comprises means for routing the data over a network. The means for routing the data over the network preferably include the first router and a first network-coupled address handler. The first router is preferably an extended T=1 router, including an extended routing table. In an embodiment of the present invention, the data may be routed over an internet protocol network, over a broadband network, over a wide area network or over another network through which data is normally sent. An embodiment of a system for routing data between a smart card and a component over a network further comprises means for receiving the data at a second router. The means for receiving the data at the second router preferably comprises a second network-coupled address handler. The second router is also preferably an extended T=1 router, including an extended routing table. An embodiment of the system of the present invention also comprises means for sending the data from the second router to the component device. The means for sending the data from the second router to the component device preferably comprises a node address handler. In one embodiment of the present invention, the component device is a security access module, including a second smart card that authenticates the first smart card. In another embodiment, the component device may be a terminal application responsible for starting and operating a terminal. In a further embodiment, the component device may be a data storage device, responsible for storing data from smart cards in non-volatile memory. In another embodiment, the component device may be a terminal having a display device and a keyboard.
Another embodiment of the present invention relates to a system for routing data between a first cluster and a second cluster over at least one network. The system comprises means for sending data from the first cluster to the at least one network and means for receiving the data from the at least one network at the second cluster. The means for sending the data from the first cluster to a network preferably comprise a first component device, a first node address handler, a router and a network-coupled address handler found in the first cluster. In one embodiment, the first component device is a smart card having a microprocessor. The router is preferably an extended T=1 router, including an extended routing table. In another embodiment, the first cluster may comprise more than one component device and a node address handler associated with each component device. In addition to a smart card, another component device in the first cluster may be a terminal having a display device and a keyboard. In addition to communicating with each other, the component devices in the first cluster may also communicate with component devices in other clusters by utilizing a system of the present invention. In a preferred embodiment of the present invention, the means for sending data from the first cluster to the at least one network further comprises a network-coupled address handler coupled to each network. The first cluster may send data to the second cluster over an internet protocol network, over a broadband network, over a wide area network or over another network through which data is normally sent. According to an embodiment of the present invention, the means for receiving the data from the network at the second cluster comprise a second network-coupled address handler, a second router, a second node address handler and a second component device. In one embodiment, the component device in the second cluster is a security access module, including a second smart card that authenticates the smart card in the first cluster. The second router is preferably an extended T=1 router, including an extended routing table. In another embodiment, the second cluster may comprise more than one component device and a node address handler associated with each component. For example, if a first component device in the second cluster is a security access module, a second component device in the second cluster may be a data storage device. The data storage device and the smart card would preferably communicate with each other using the node address handlers and the second router. In a still further embodiment, a third component device in the second cluster may be a clearing and settlement device, which preferably communicates with the other components using the node address handlers and the second router.
A still further embodiment of a system for routing data between at least two clusters over at least one network comprises a first hard wired cluster comprising at least one component device, a node address handler associated with each component device, a router and at least one network-coupled address handler. The system further comprises a second hard wired cluster comprising at least one component device, a node address handler associated with each component device, a router and at least one network-coupled address handler. A component device in the first cluster sends data via the node address handler associated with the component device in the first cluster to the router in the first cluster. The router in the first cluster sends data through a network-coupled address handler in the first cluster to a network. The router in the second cluster receives the data from the network via a network-coupled address handler in the second cluster. A component device in the second cluster receives the data from the router in the second cluster via the node address handler associated with the component device in the second cluster. The routers in each cluster are extended T=1 routers. The data may be sent over an internet protocol network, over a broadband network, over a wide area network or over another network through which data is normally sent. A cluster may be coupled to more than one network through a network-coupled address handler associated with each network. For example, a cluster may be coupled to both an internet protocol network and a broadband network through a network-coupled address handler associated with each network. Additionally, each cluster may be coupled to the same network through more than one network-coupled address handler.
Additional objects, advantages and novel features of the invention will be set forth in part in the description which follows, and in part will become more apparent to those skilled in the art upon examination of the following or may be learned by practice of the invention.